MODULE 3 · LESSON 3
Free — no login requiredSign in to track progress, save quiz attempts and enrol in the full course.
Sign in to track progress / enrolPasswords, Managers, and What to Do This Week
This lesson is the practical one. It ends with an ordered list you can work through in about fifteen minutes, and doing so puts you ahead of most people and most small organisations.
Why the old password rules made things worse
For twenty years the standard advice was: at least eight characters, an uppercase letter, a number, a special character, changed every ninety days.
That advice was not merely unhelpful, it actively degraded security, and the reason is that it optimised for the wrong attack while ignoring how people behave.
Told to add complexity, people do the predictable thing. password becomes Password1, then Password1!. Forced to change quarterly, they cycle Password1!, Password2!, Password3!. Attackers know these patterns perfectly well and their tools try them first. The rules produced passwords that felt complex to the person and were entirely predictable to the software.
Meanwhile the rules encouraged the genuinely damaging behaviour. A password hard to remember gets reused everywhere, and reuse is what turns an unrelated forum breach into a compromise of your work account.
Length beats complexity, because the difficulty of guessing grows far faster with length than with the size of the character set. A passphrase of four or five unrelated words is both easier to remember and dramatically harder to guess than a short string with punctuation in it.
But the real answer is not to remember passwords at all.
What a password manager actually does
The obvious benefit is that it generates long random passwords, stores them, and means a breach at one service cannot affect any other.
The second benefit is less discussed and defends against exactly the attack in the previous lesson.
A password manager will not autofill your credentials into a lookalike domain. It matches on the exact domain, not on appearance. If you land on a page that is a pixel perfect copy of your bank, hosted on a domain one character different, the manager simply does not offer to fill it in.
That silence is a signal, and it is a signal generated by software rather than by your judgement. You are not being asked to spot a fraudulent site. You are being told that the site is not the one you saved.
The practical habit: if your password manager does not offer to fill a login you have saved, stop. Do not copy and paste it manually. Nine times out of ten it is a harmless mismatch, and the tenth time it is the only warning you will get.
Recovery routes are part of the attack surface
People secure the front door and leave the side entrance open.
Every account has a recovery path, and that path is a way in. If your email can be recovered by answering questions about your mother's maiden name and the town you were born in, then the security of that account is the security of facts that are frequently public or discoverable.
Two things follow.
Treat security questions as passwords. There is no requirement to answer them truthfully. Generate a random string, store it in your password manager, and use that. An honest answer is a fact an attacker can research; a random string is not.
Audit the recovery routes on your important accounts. Old phone numbers you no longer control, personal addresses from a previous job, a recovery email you have not opened in years. Each one is a route in, and old routes are the ones nobody monitors.
Do these five things
In this order. The order is deliberate, because it protects the master key first.
- Add a passkey to your primary email account. Look for "passkeys" or "security keys" in account security settings. This single change defeats the most common serious attack against you.
- Install a password manager and let it generate everything. Start with the accounts that matter, and let the rest migrate as you sign in over the following weeks. It does not need to be done in one sitting.
- Move your important accounts off SMS. Passkey where available, authenticator app where not. Email and banking first.
- Audit recovery routes. Remove old phone numbers and stale recovery addresses. Replace truthful security answers with stored random strings.
- Find the "sign out of all devices" control on your main accounts now, while nothing is wrong, so you can reach it immediately under pressure.
This is the most common and most reasonable objection to password managers, and it deserves a real answer rather than reassurance.
Yes, it concentrates risk. The question is whether the concentrated risk is smaller than the risk it replaces, and it is, for three reasons.
The alternative is not a safer system, it is a worse one. Nobody memorises seventy unique strong passwords. The realistic alternatives are reuse, a written list, or a browser storing them with weaker protection. Reuse is the mechanism behind an enormous share of real compromises. You are not choosing between a manager and perfect memory; you are choosing between a manager and reuse.
The vault is encrypted with a key the provider does not hold. In a properly designed manager, decryption happens on your device using your master password. A breach of the provider exposes encrypted blobs. This is not hypothetical comfort: password manager providers have been breached, and the practical consequence for users with strong master passwords has been substantially limited, whereas a breach of a service where you reused a password is immediately exploitable.
It removes a much larger risk. Reuse means the security of your work account equals the security of the least competent site you ever registered with. That site will eventually be breached. The manager makes that event irrelevant.
Two things make the concentration acceptable in practice. Protect the vault with a long passphrase used nowhere else, and add a second factor to the manager itself, ideally a passkey or hardware key. Then the concentrated risk requires both your passphrase and your physical second factor, which is a materially harder problem than any of the attacks it prevents.
The honest summary: a password manager is a real single point of failure, deliberately accepted, because it eliminates a larger and far more frequently exploited one.
You visit what appears to be your bank's login page and your password manager does not offer to autofill your saved credentials. What is the correct response?
Length over complexity
Click to flipGuessing difficulty grows far faster with length than with character variety. Complexity rules produced predictable substitutions and encouraged reuse.
Click to flip backComplexity rules produced predictable passwords and encouraged reuse, which is the habit that actually causes compromises. Use a manager, let it generate everything, and treat its refusal to autofill as a genuine warning, since it matches domains rather than appearances. Secure recovery routes with the same seriousness as the login itself, because a stale phone number is a way in that nobody monitors. Then do the five steps in order, starting with a passkey on your email, because email is the master key to nearly everything else.